Good luck updating old and hand-configured VM. Most of the time running Docker image is just invoking one app without entire system services (except host system), then securing is often just bumping base image version to some recent one.
You use packer and vagrant for that, and you bump base image versions, just like in Dockerfiles.